Why does journalctl say "-- no entries --"?

Question

For example:

┌─[10:50:38/hypership/root/~]
└─╼ journalctl -b
No journal files were found.
-- No entries --

┌─[10:50:46/hypership/root/~]
└─╼ journalctl --verify
No journal files were found.

/var/log is full of files though, and this was working before. Seems like an Arch Linux update may have caused this.

Any idea what the problem may be? What more info can I provide?

Answer 1

1. sudo -i if not already.
2. Try running journalctl -b to see messages from the current boot.
3. If you still get -- No entries --, run journalctl --verify.
4. If you get No journal files were found, something is corrupted with the journal service itself. Run systemctl status systemd-journald*
5. If the services are all "green" (active/running), something is borked with the log files in /var/log/journal/<hash>. Try running the following to recreate them:

systemctl restart systemd-journald.service

The previous command will restart journald with a new hash under /var/log/journal. Now if you run journalctl -b you should see messages about the service itself starting.

Unfortunately the files under /var/log/journal are not parseable so figuring out the initial problem may be difficult, but at least logs going forward will work again.